Whitepaper
Version 1.0 · April 2026
This document describes the design, mechanics, and risk model of Keystone Finance. It is intended for prospective depositors, protocol integrators, and auditors. All simulated performance figures are illustrative estimates derived from historical data and documented strategy mechanics — they are not actual returns. See Historical Simulation for full methodology and caveats.
Table of Contents
1. Abstract
Keystone Finance is the on-chain analog of a multi-strategy hedge fund: a permissionless, multi-strategy fund implemented as four Anchor programs on Solana. Three sleeves — Keystone Alpha (directional LST accumulation), Keystone Neutral (delta-neutral basis and funding carry), and Keystone Defense (JupSOL baseline plus dislocation deployments) — each maintain their own state, share mint, and NAV. Keystone Core sits above them, routing depositor capital per a chosen risk profile and rebalancing automatically based on market conditions.
Depositors make a single decision (risk profile), receive a single share token (ksCORE), and earn across all three sleeves simultaneously. There are no fund managers, no discretionary decisions, and no off-chain components. Every allocation, rebalance, and fee is executed and settled on-chain by open smart contracts callable by any wallet.
Simulated across 40 months spanning a full crypto market cycle (Jan 2023 – Apr 2026, including the 2025 bear market), all three risk profiles produced Sharpe ratios above 1.0 on the reproducible engine in Historical Simulation, with annualized returns from roughly 13% (Conservative, Neutral-heavy) to 26% (Growth).
2. Problem Statement
Crypto treasury management is hard for three compounding reasons.
Market regimes change faster than portfolios do. A strategy that works in a bull market (maximum SOL exposure) destroys capital in a bear. Switching strategies requires constant monitoring, human judgment, and execution — all of which fail at the moments they matter most.
Yield sources are non-overlapping. The highest-returning Solana strategies — directional LST accumulation, basis carry, and liquidation arbitrage — operate in completely different market conditions. No single strategy captures all three. Portfolios that pick one leave the others on the table.
On-chain capital is either inactive or exposed. Most DeFi positions require active management: monitoring health factors, adjusting collateral, reacting to funding rate shifts. Capital that isn't being actively managed is either idle (earning nothing) or overexposed (one event away from liquidation).
Keystone addresses all three by treating capital allocation as an automated protocol function, not a human one.
3. The Keystone Architecture
Keystone is structured as a two-layer system:
Layer 1 — Funds. Three independent on-chain programs, each with its own fund state, share token, and NAV accounting. Each fund can be deposited into directly or accessed through Core.
Layer 2 — Core. A portfolio orchestration program that holds shares in all three funds on behalf of depositors. Core accepts USDC (or any token via Jupiter swap), mints ksCORE to depositors, and routes capital to funds according to the chosen risk profile. Rebalancing restores allocations to target weights as drift accumulates.
The separation of concerns is intentional. The three funds are standalone — auditable, integrable, and usable independently. Core adds the portfolio layer: a single entry point, a single share token, and automated multi-fund management.
4. The Three Funds
4.1 Keystone Alpha Fund — Directional Accumulation
Philosophy: accumulate SOL when it is cheap relative to its all-time high; reduce exposure when it is expensive.
The fund maintains a position between 20% and 80% jitoSOL (the remainder in USDC lent on Marginfi) and adjusts weekly. The target allocation is derived from a single input: SOL's distance from its recorded all-time high (ATH).
Allocation formula:
The fund never reaches its target in a single step. Allocation changes are bounded by a regime-adjusted step size — at most 3% per rebalance in normal conditions, as low as 0.75% in deep bear markets. This prevents the fund from aggressively adding exposure into a price decline.
Market regimes:
Normal
Drawdown < 35%, vol 1–4%
3.0%
Standard operation
Low Vol Near Peak
Drawdown < 35%, vol < 1%
4.5%
More responsive; SOL cap 56%
High Vol Drawdown
Drawdown 35–55%, vol > 4%
1.5%
Slower accumulation
Bear Market
Drawdown > 55%
0.75%
Minimal movement; range 30–40%
Circuit breakers: When SOL is down > 50% from ATH and volatility exceeds 6%, rebalancing step size is cut to 30% of normal. Above 10% volatility, rebalancing is suspended entirely. These reset automatically when conditions normalize.
Yield sources:
jitoSOL staking: ~5.8% APY (MEV + native staking rewards via Jito)
Marginfi USDC lending: ~3–5% APY on idle capital
4.2 Keystone Neutral Fund — Basis and Funding Carry
Philosophy: capture the spread between spot and perpetual prices, in both directions, with zero net SOL exposure at all times.
The fund runs one of three states:
State 1 — Standard Basis (positive funding): Funding rates are positive — perpetuals trade at a premium to spot. Long traders pay short traders.
State 2 — Reverse Basis (negative funding): Funding rates are negative — perpetuals trade at a discount to spot. Short traders pay long traders.
State 3 — jitoSOL Parking (gate blocking): When funding rates are too compressed to justify deployment, idle USDC earns nothing by default. With jitoSOL parking mode enabled, capital is swapped to jitoSOL and earns staking yield (~5–8% APY) until carry conditions recover — eliminating dead periods.
Risk controls:
Continuous Jupiter Perps position health monitoring; auto-deleverage below 1.2x
Funding rate ring buffer (8 snapshots); gate requires N consecutive confirming periods before deployment
NAV drawdown guard: configurable automatic close if share price falls more than X basis points from peak
Volatility-adjusted position sizing: 50%–150% of base position based on realized volatility
Yield sources:
Funding payments from Jupiter Perps (both directions): 5–15% APY when active
jitoSOL staking yield (when parked or in standard basis): ~5.8% APY
Blended estimated range: 11–21% APY
4.3 Keystone Defense Fund — Crisis Yield Capture
Philosophy: hold liquid capital as a staking baseline during normal markets; deploy into the conditions that break other strategies — liquidation cascades, extreme negative funding, and collateral dislocations.
Defense has three deployment modes that can run simultaneously:
Mode 1 — Negative Funding Capture: When perpetual funding rates are deeply negative, crowded short-sellers pay long positions. Defense enters long SOL-PERP positions to collect these payments. Cascade pre-positioning allows Defense to size into positions ahead of predicted liquidation events when on-chain signals (rising OI + leverage) indicate a cascade is building.
Mode 2 — Liquidation Arbitrage: During sharp price declines, under-collateralized borrowers on Marginfi are liquidated. Defense acts as liquidator — repaying debt in exchange for collateral at a 5–10% discount. Every purchase is verified on-chain against Pyth oracle price; transactions revert if the discount threshold is not met.
Mode 3 — Distressed Collateral Purchases: Market crashes temporarily misprice LSTs and other collateral assets. Defense purchases discounted assets and holds until market recovery. Oracle-verified minimum discount (configurable min_discount_bps) prevents deploying into non-dislocated conditions.
Baseline state: When no deployment condition is active, the fund holds JupSOL (earning ~5–8% APY via Jupiter's validator network) and optional Marginfi lending. The fund is never fully idle.
Capital allocation model:
JupSOL + USDC (liquid)
50–60%
Baseline yield + dry powder
Negative funding trades
20–30%
Long SOL-PERP during bearish markets
Liquidation reserve
10–20%
Immediate deployment into cascades
Fee structure: 0% management fee. Defense earns a performance fee only when it generates returns above the high-water mark. Capital in the passive baseline state earns staking yield that accrues entirely to depositors.
5. Keystone Core — Portfolio Orchestration
Core is the main entry point for depositors. It holds positions in all three funds simultaneously and presents depositors with a single share token (ksCORE) representing a weighted claim across the portfolio.
Deposit Flow
Withdrawal Flow
Rebalancing
Over time, relative fund performance causes actual allocations to drift from targets. The keeper calls rebalance when drift exceeds the configured threshold (default: 5%). Rebalancing sells from over-weight funds and buys into under-weight ones, restoring target allocations.
Accepted Deposit Tokens
USDC
Direct deposit
SOL / wSOL
Jupiter swap to USDC
JupSOL
deposit_jupsol — Jupiter swaps all JupSOL to USDC (PDA-signed), then routed to all three funds
Any other token
Jupiter swap to USDC
The JupSOL deposit path uses a PDA-signed Jupiter swap so the full amount is converted to USDC before distribution — every fund receives USDC only.
6. Risk Profiles
Depositors choose one risk profile at deposit time. Each profile is a fixed weighting across the three funds, with on-chain guardrail bounds enforced by the program.
Conservative
10%
60%
30%
Balanced
20%
55%
25%
Growth
35%
40%
25%
Profile design rationale:
Conservative is Neutral-heavy — the delta-neutral carry fund with jitoSOL parking produces consistent returns with very low drawdown in bear markets. The 30% Defense allocation provides a crash floor; 10% Alpha keeps directional beta the lowest of the three profiles while all three still clear Sharpe > 1 in the documented backtest.
Balanced sits between the two extremes: enough Directional exposure to capture bull markets meaningfully, enough Neutral and Defense to limit bear-market damage to single-digit drawdowns.
Growth targets maximum Sharpe-efficient Directional exposure. The 35% Alpha allocation was chosen specifically over higher alternatives (40%, 45%, 55%) because the Sharpe ratio peaks at 35% and degrades as Alpha increases further — additional Directional weight adds volatility drag faster than it adds return. At 35/40/25, all three profiles clear Sharpe 1.0.
7. Simulated Performance
All figures are simulated. Keystone Core was not deployed during the periods modeled. Results use Binance SOLUSDT month-end closes and a Binance SOL perp funding monthly proxy through Apr 2026, with simplified fee and rebalance mechanics (
npm run fund:simulate). Data current as of 2026-05-06. See Historical Simulation for full methodology and caveats.
Full-Cycle Results (Jan 2023 – Apr 2026, 40 months)
Conservative
$150
+49.7%
12.9%
1.35
−3.1%
Balanced
$176
+75.6%
18.4%
1.14
−7.1%
Growth
$217
+117.2%
26.2%
1.02
−12.8%
USDC Lending (benchmark)
$114
+14.2%
4.1%
—
~0%
SOL (Jan 2023 month-end entry)
$347
+247.4%
—
0.77
(spot)
SOL (Dec 2022–Apr 2026, 40 mo)
$833
+733.4%
—
0.95
(spot)
Sharpe ratios annualized; USDC risk-free rate ~4%/yr (0.33%/mo).
By Market Phase
Bull (Jan 2023 – Jan 2025)
+868.9%
+41.5%
+63.2%
+97.6%
Bear (Jan 2025 – Mar 2026)
−64.1%
+0.6%
−3.7%
−9.7%
Full cycle
+733.4% (Dec ’22 anchor)
+49.7%
+75.6%
+117.2%
Drawdown Detail
Conservative
2025-09
2026-02
−3.1%
(sim month-end series)
Balanced
2025-09
2026-02
−7.1%
(sim month-end series)
Growth
2025-09
2026-02
−12.8%
(sim month-end series)
Live Snapshot (2026-05-06)
A 6-day flat-carry update applied to the Apr 2026 indices (SOL spot $88.82, +6.90% MTD; perp funding APR ~5.10%): Conservative → $150.65, Balanced → $177.55, Growth → $221.28. Reproduce with npx tsx scripts/simulations/snapshot-live.ts. See Historical Simulation for the methodology.
SOL Direct Comparison
Spot SOL from a January 2023 month-end entry still shows a large cumulative gain (+247.4% in this data set) but Sharpe below 1.0 versus a 4%/yr cash hurdle on monthly returns. Including the Dec 2022 → Jan 2023 leg (same 40-month path as the fund simulation) raises the terminal multiple further (+733.4%) but does not fix risk-adjusted shortfall versus Core in this model. Keystone profiles target drawdown-contained participation rather than maximum spot beta.
8. Fee Structure
Fees are settled by minting new share tokens to the fee recipient address. No USDC is deducted from depositor balances at any point. Fees are calculated and collected when collect_fees is called.
Fee Rates
Alpha
0.5% / yr
20% above HWM
0.1% per rebalance
Neutral
0.5% / yr
20% above HWM
—
Defense
0%
20% above HWM
—
High-water mark: Performance fees apply only to net-new gains above the prior peak share price. No fee is charged during recovery from a drawdown — the fund must reach a new high before any performance fee accrues.
Defense management fee: Defense charges no management fee because the fund spends most of its time in a passive baseline state. Charging a recurring fee on capital waiting for deployment conditions would erode the staking yield that should accrue to depositors. The fund earns only when it generates alpha above the HWM.
Revenue Projections
$1M
$5K / yr
$5K–$20K / yr
$10K–$25K / yr
$10M
$50K / yr
$50K–$200K / yr
$100K–$250K / yr
$100M
$500K / yr
$500K–$2M / yr
$1M–$2.5M / yr
Performance estimates assume 5–15% annual returns.
9. NAV and Share Pricing
All three funds and Core use the same share pricing model:
Share price starts at 1.00 USDC and increases as the fund earns yield. A depositor's withdrawal entitlement at any time equals shares_held × current_share_price.
NAV Calculation by Fund
Alpha Fund:
Neutral Fund (standard basis):
Neutral Fund (reverse basis):
Defense Fund:
Core:
NAV is recomputed on every deposit, withdrawal, and fee collection. SOL/USD prices are read from Pyth oracle with a 5-minute staleness check and 2% confidence interval check. Stale or low-confidence oracle reads revert the transaction.
10. Security Model
Access Control
Admin
Update parameters, pause operations, collect fees, transfer authority
Public (permissionless)
Deposit, withdraw, trigger rebalance, deploy capital, settle funding
Fund PDA
Signs all token operations on behalf of the fund — program-derived, no private key
Fund authority can be transferred to a multisig at any time via transfer_authority.
Protections Across All Funds
Emergency pause
Admin halt of all operations
Deposit caps
Configurable maximum TVL per fund
Oracle validation
Pyth staleness check (5 min) + confidence check (2%)
Integer arithmetic
No floating-point; overflow-safe 128-bit intermediates
Slippage protection
Configurable max slippage on all Jupiter swaps
High-water mark
Performance fees never charged twice on the same gains
Rate limiting
Cooldown periods between sensitive operations
Alpha-specific
Volatility-aware regime detection (4 regimes)
Step-capped allocation changes (max 3% per rebalance)
Circuit breakers that reduce or suspend rebalancing during extreme stress
Neutral-specific
Continuous Jupiter Perps position health monitoring with auto-deleverage
Funding rate ring buffer and gate requiring N consecutive confirming periods
NAV drawdown guard with configurable trigger
Volatility-adjusted position sizing
Audit Status
The contracts are currently unaudited. A pre-mainnet security audit is planned with a top-tier Solana auditor (Ottersec / Sec3 / Neodyme). Significant capital should not be deployed until the audit is complete and results are published.
11. Protocol Architecture
Programs
Keystone Core
Devnet
rDd3hjjEdH2xJWH9RnQupX7ZTPxrzmBZhL76eS8dW8c
Keystone Alpha
Devnet
2JTb5UiM6mAYDUmnSiTgZXTTEJAJs98YRDcKLU6AGeZN
Keystone Neutral
Devnet
BxKFa6GRKYgNKxRzJ4kXCHiDo2PodpNtKVWhJTZMtAXR
Keystone Defense
Devnet
FKtpFEd4B5jGRkgLf5AN2eZMikmkEJYf59XzR6YbTxPA
All mainnet program IDs are pending post-audit deployment.
External Protocol Dependencies
Pyth
SOL/USD price oracle
Alpha, Neutral, Defense
Jupiter
Token swaps (USDC ↔ jitoSOL, etc.)
Alpha, Neutral, Defense
Marginfi
USDC lending; jitoSOL borrowing (reverse basis)
Alpha, Neutral
Kamino
jitoSOL borrowing (reverse basis)
Neutral
Jupiter Perps
Perpetual futures (SOL-PERP)
Neutral, Defense
Jito
jitoSOL liquid staking
Alpha, Neutral
Jupiter (JupSOL)
JupSOL liquid staking
Defense, Core
Key Instructions
Core:
initialize_portfolio
Admin
Creates portfolio; sets fixed risk_profile and default targets
deposit / deposit_jupsol / deposit_with_swap
User
Route value to funds; risk_profile arg must match portfolio
withdraw / withdraw_with_swap
User
Burn ksCORE; redeem USDC (optional token out on swap path)
migrate_portfolio
User
Move ksCORE between portfolio IDs in one transaction
rebalance
Anyone (permissionless)
Restores target allocations when drift / interval allow
collect_fees
Admin
Portfolio authority — management + performance fee accrual
update_params
Admin
Adjust targets within profile bounds, fees, caps, rebalance tuning
toggle_emergency
Admin
De-risk target override (not the same as pause)
pause_portfolio
Admin
Halt deposits and routing
Alpha:
rebalance
Keeper (permissionless)
Reads oracle, computes regime, swaps toward target
deposit
Core / User
Routes USDC or LST
withdraw
Core / User
Redeems proportional USDC
collect_fees
Anyone (permissionless)
Mints management + performance + rebalancing fee shares to admin ATA
Neutral:
deploy_capital
Keeper (permissionless)
Opens standard basis; auto-withdraws Marginfi USDC if parked
deploy_reverse
Keeper (permissionless)
Opens reverse basis position
park_capital
Keeper (permissionless)
jitoSOL→USDC then Marginfi USDC lending (when basis flat)
park_in_jitosol
Keeper (permissionless)
Parks idle USDC in jitoSOL for staking yield
settle_funding
Keeper (permissionless)
Collects funding, updates ring buffer
emergency_close_position
Keeper (permissionless)
Closes basis position on trigger
close_reverse
Keeper (permissionless)
Closes reverse basis on funding recovery
12. Risk Disclosures
Keystone Finance involves significant financial risk. The following risks apply.
Smart contract risk. The programs are unaudited. Bugs, exploits, or upgrade keys held by the admin could result in loss of funds. Do not deploy capital you cannot afford to lose until post-audit.
Oracle risk. SOL/USD pricing relies on Pyth. Oracle failure, manipulation, or extreme latency could cause incorrect NAV calculations, mistimed rebalances, or erroneous fee collection. Staleness and confidence checks mitigate but do not eliminate this risk.
SOL price risk. Alpha and Growth profiles have meaningful directional SOL exposure. A sustained multi-year bear market (e.g. 2022: SOL −94%) would produce significant drawdowns in these profiles.
Funding rate risk. Neutral Fund performance depends on Jupiter Perps perpetual funding rates remaining above zero consistently enough to justify position costs. Sustained near-zero funding with Kamino borrow costs for the reverse leg can compress or eliminate carry.
Liquidation risk. Neutral Fund uses Jupiter Perps leverage. Health factor monitoring and auto-deleverage protect against liquidation but do not eliminate it in extreme rapid-move scenarios.
Counterparty protocol risk. Capital is deployed across Jupiter Perps, Marginfi, Kamino, and Jito. A hack, exploit, or protocol insolvency event at any of these could result in partial or complete loss of funds deployed there.
jitoSOL / JupSOL depeg risk. Both LSTs carry a risk of trading below fair value due to redemption queue pressure, validator slashing, or market panic. Circuit breakers activate above a 2% deviation from fair value but cannot prevent losses from sudden severe depegs.
Keeper failure risk. Many operations (rebalancing, funding settlement, position deployment) depend on the keeper bot executing permissionless instructions on schedule. A keeper outage means no rebalancing, no funding collection, and no automated position management until the keeper is restored. Any wallet can step in as keeper — the protocol is permissionless — but in practice most deployments rely on the operator-run keeper.
Simulated performance. All historical figures are simulated. Past simulated performance does not predict future results. Real execution adds slippage, downtime, oracle latency, protocol liquidity constraints, and keeper reliability variability that are not captured in the simulation.
For questions, integration support, or to report security issues, see the repository at github.com/kamwithak/keystone-contracts.
Keystone Finance is not a registered investment adviser. Nothing in this document constitutes investment advice. Deposit only what you can afford to lose.
Last updated